5 ms·

What settings exactly do I have to change to get GMail to never unlock my account by SMS alone? I have enabled proper 2FA on my Google account with U2F, but I

What settings exactly do I have to change to get GMail to never unlock my account by SMS alone? I have enabled proper 2FA on my Google account with U2F, but I haven't disabled everything else yet because I only have one token, and I still need something like TOTP for stuff that uses Google accounts, but doesn't support U2F. As a closely related remark, I wish U2F would just get popular enough, it's pretty convenient, isn't vulnerable against the kind of attack SMS-based 2FA is, and protects against phishing. But almost nobody outside Google supports it, and OS/Application support is rather incomplete or requires additional setup.

kuschku 9y ago
Also, Google only supports U2F in Chrome – even if you have an addon to support it in Firefox, Google won’t support it (because they activate it based on Useragent, not on actually available functionality)
gregstoll 9y ago
The Tech Solidarity guide at https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm has detailed instructions on how to set up 2FA with U2F and then remove SMS 2FA. (I've been holding off because I use Firefox - hopefully U2F will get more support soon!)
glandium 9y ago
Something that is infuriating is that when you have 2FA enabled on Google, they insist that you add a backup phone number that a bot calls to give you a verification code, in case, you know, you lost your second factor. Which is nice and all, but now, you're back to having a second factor that is about as vulnerable as SMS.
- inferiorhuman 9y ago
  You can remove the phone after you add another factor (ex: TOTP device).
  - deleted 9y ago
    [deleted]
aftbit 9y ago
U2F is ludicrously hard to implement. Adding TOTP 2FA to an existing webapp will take a competent developer a few hours, using only a 10-line code snippet and the standard library. Adding U2F means learning a ton of complicated concepts and either using a giant, poorly documented library provided by Yubico or writing a bunch of tricky crypto code from scratch. :(
- zxcvbn4038 9y ago
  I disagree, U2F is relatively easy to implement once you understand it, I've contributed to several open source implementations and eventually wrote one of my own.
metafunctor 9y ago
I don't have a phone number in any of my Google accounts, just Google Authenticator for 2-step verification. I don't recall ever having a problem with this setup. Are there services that require a Google account to sign in, but don't work if you don't have a phone number?
srathi 9y ago
Go to "account recovery" option and remove the phone number listed there.
aleph_naught 9y ago
Go to: https://myaccount.google.com/signinoptions/two-step-verification https://myaccount.google.com/signinoptions/two-step-verifica... And remove SMS from the listing. I currently have 3 2FA mechanisms listed: Security-Key/Yubikey (default), Authenticator App (set on two devices), and Backup codes which I downloaded (and at some point will print and place in a safe deposit box). Losing access to my two gmail accounts would be a complete nightmare---more so than my bank/brokerage accounts. Some brokerages like TD Ameritrade do not even offer 2FA. In my case, paranoia mode for email accounts is completely warranted. I really wish U2F becomes the standard across all web services. It seems insane that, in some scenarios, the only barrier against financial ruin is the gullibility of your cell-phone provider's customer service rep.
- davchana 9y ago
  I might be wrong, tried long ago, but maybe it is that even if you don't list SMS as your backup code delivery option, clicking forgot password (need only your username), and then going to Other Options, and choosing to gey identified by providing a phone number (Google shows type your number * * * * * * -1234), hijacking its SMS, can provide access to your account.
davchana 9y ago
I asked the same at https://security.stackexchange.com/questions/151675/how-to-secure-google-account-from-sim-hijacking-intercepting-two-factor-sms-co https://security.stackexchange.com/questions/151675/how-to-s... Basically, the safest is, add Google Auth via App to your account, then remove all the phone numbers from Google. If any phone number is linked to your account, no matter what your account recovery options are, Google will always give you option to "recover" it by SMS.

kuschku 9y ago

Also, Google only supports U2F in Chrome – even if you have an addon to support it in Firefox, Google won’t support it (because they activate it based on Useragent, not on actually available functionality)

gregstoll 9y ago

The Tech Solidarity guide at https://techsolidarity.org/resources/security_key_gmail.htm https://techsolidarity.org/resources/security_key_gmail.htm has detailed instructions on how to set up 2FA with U2F and then remove SMS 2FA. (I've been holding off because I use Firefox - hopefully U2F will get more support soon!)

glandium 9y ago

Something that is infuriating is that when you have 2FA enabled on Google, they insist that you add a backup phone number that a bot calls to give you a verification code, in case, you know, you lost your second factor. Which is nice and all, but now, you're back to having a second factor that is about as vulnerable as SMS.

inferiorhuman 9y ago
You can remove the phone after you add another factor (ex: TOTP device).
- deleted 9y ago
  [deleted]

aftbit 9y ago

U2F is ludicrously hard to implement. Adding TOTP 2FA to an existing webapp will take a competent developer a few hours, using only a 10-line code snippet and the standard library. Adding U2F means learning a ton of complicated concepts and either using a giant, poorly documented library provided by Yubico or writing a bunch of tricky crypto code from scratch. :(

zxcvbn4038 9y ago
I disagree, U2F is relatively easy to implement once you understand it, I've contributed to several open source implementations and eventually wrote one of my own.

metafunctor 9y ago

I don't have a phone number in any of my Google accounts, just Google Authenticator for 2-step verification. I don't recall ever having a problem with this setup. Are there services that require a Google account to sign in, but don't work if you don't have a phone number?

srathi 9y ago

Go to "account recovery" option and remove the phone number listed there.

aleph_naught 9y ago

Go to: https://myaccount.google.com/signinoptions/two-step-verification https://myaccount.google.com/signinoptions/two-step-verifica... And remove SMS from the listing. I currently have 3 2FA mechanisms listed: Security-Key/Yubikey (default), Authenticator App (set on two devices), and Backup codes which I downloaded (and at some point will print and place in a safe deposit box). Losing access to my two gmail accounts would be a complete nightmare---more so than my bank/brokerage accounts. Some brokerages like TD Ameritrade do not even offer 2FA. In my case, paranoia mode for email accounts is completely warranted. I really wish U2F becomes the standard across all web services. It seems insane that, in some scenarios, the only barrier against financial ruin is the gullibility of your cell-phone provider's customer service rep.

davchana 9y ago
I might be wrong, tried long ago, but maybe it is that even if you don't list SMS as your backup code delivery option, clicking forgot password (need only your username), and then going to Other Options, and choosing to gey identified by providing a phone number (Google shows type your number * * * * * * -1234), hijacking its SMS, can provide access to your account.

davchana 9y ago

I asked the same at https://security.stackexchange.com/questions/151675/how-to-secure-google-account-from-sim-hijacking-intercepting-two-factor-sms-co https://security.stackexchange.com/questions/151675/how-to-s... Basically, the safest is, add Google Auth via App to your account, then remove all the phone numbers from Google. If any phone number is linked to your account, no matter what your account recovery options are, Google will always give you option to "recover" it by SMS.